svn commit: r421090 - head/security/vuxml
Matthias Andree
mandree at FreeBSD.org
Mon Aug 29 19:00:38 UTC 2016
Author: mandree
Date: Mon Aug 29 19:00:36 2016
New Revision: 421090
URL: https://svnweb.freebsd.org/changeset/ports/421090
Log:
Document mailman < 2.1.23 CVE-2016-6893, insufficient CSRF protection.
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Mon Aug 29 18:56:15 2016 (r421089)
+++ head/security/vuxml/vuln.xml Mon Aug 29 19:00:36 2016 (r421090)
@@ -58,6 +58,38 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec">
+ <topic>mailman -- CSRF protection enhancements</topic>
+ <affects>
+ <package>
+ <name>mailman</name>
+ <range><lt>2.1.23</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Mark Sapiro reports:</p>
+ <blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668">
+ <p>CSRF protection has been extended to the user options page. This
+ was actually fixed by Tokio Kikuchi as part of the fix for LP:
+ #775294 and intended for Mailman 2.1.15, but that fix wasn't
+ completely merged at the time. The full fix also addresses the
+ admindb, and edithtml pages as well as the user options page and the
+ previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url>
+ <url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url>
+ <cvename>CVE-2016-6893</cvename>
+ </references>
+ <dates>
+ <discovery>2016-08-19</discovery>
+ <entry>2016-08-29</entry>
+ </dates>
+ </vuln>
+
<vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6">
<topic>libxml2 -- multiple vulnabilities</topic>
<affects>
More information about the svn-ports-all
mailing list